1. Field of the Invention
This invention relates to the field of data processing systems. More particularly, this invention relates to systems for detecting unwanted properties in received e-mail messages.
2. Description of the Prior Art
E-mail has become an accepted and fundamental part of both business and personal communication. Whilst the benefits of the widespread use of e-mail are considerable, a problem that has arisen is that received e-mail messages may have unwanted properties. As an example, it has become increasingly common for e-mail messages to bear computer viruses that can be damaging to computer systems upon which they are received. E-mail has the potential to rapidly distribute such computer viruses and is becoming an increasingly common and destructive technique used by virus writers to propagate their viruses. Another example of e-mail having unwanted properties is so called spam e-mail, which is unsolicited by the recipient and often contains advertising or other unwanted material. As a consequence of the speed and low cost of sending such spam e-mails, the number of spam e-mails received by a user may become inconvenient to the degree that it interferes with their legitimate desired received e-mails.
It is known to provide e-mail anti-virus computer systems for automatically scanning received e-mails to detect any computer viruses they may be carrying. It is also known to provide anti-spamming filters that may be set to detect the receipt of multiple e-mails with the same title or from the same recipient and then block such e-mails as they are highly likely to be spam e-mails.
A problem with the above anti-virus and anti-spamming systems is that they are necessarily at least one step behind the virus writer or spam originator. More particularly, a new computer virus may be mass e-mailed to a large number of recipients causing a rapid outbreak of computer virus induced damage to computer systems. It takes a finite amount of time before anti-virus system providers can react to a new virus and generate appropriate counter measures which may then be distributed to their customers. During this delay period, many computer virus infected e-mails may be received by users and cause damage to their computer systems. Considerable effort is made to react as quickly as possible to computer virus outbreaks and create and distribute appropriate counter measures, but even if this process takes less than one hour, the speed of e-mail distribution is such that there may still be a considerable amount of damage to computer systems caused during this period.
In the case of anti-spamming systems, such as title, sender or content filters, it is normally only after receipt of a threshold number of e-mails containing consistent characteristics that such filters may be triggered or created. By this time, the spam e-mails already received will have made their way to end users causing disruption to those end users.
Viewed from one aspect the present invention provides a method of detecting an e-mail message having one or more unwanted properties using one or more tests, said one or more tests being updateable in response to detection of new unwanted properties, said method comprising the steps of:
receiving an e-mail message having associated one or more e-mail message characteristics and addressed to one or more recipients for said e-mail message;
determining a minimum delay period in dependence upon said one or more e-mail message characteristics;
storing said e-mail message for said minimum delay period;
applying said one or more tests current at expiry of said minimum delay period to said e-mail message to identify if said e-mail message has any of said one or more of unwanted properties;
if said e-mail message does not have any of said one or more unwanted properties, then sending said e-mail message to said one or more recipients; and if said e-mail message does have any of said one or more unwanted properties, then blocking sending of at least a portion of said e-mail message to said one or more recipients.
Whilst it is normally the aim in e-mail processing systems to transfer a received e-mail message onto its intended recipient as rapidly as possible, the present invention moves against this preconception by deliberately introducing a minimum delay period for which an e-mail message is stored prior to being passed onto the intended recipient or recipients. Introducing such a deliberate minimum delay period significantly increases the likelihood that the tests for unwanted properties that are current at the expiry of the minimum delay period will include counter-measures developed and distributed during the minimum delay period and so may identify the problem e-mail before it reaches the user. Furthermore, by determining the minimum delay period in dependence upon characteristics of the e-mail message concerned, the delay may be selected to reflect the likelihood of a particular e-mail-message having unwanted properties.
Whilst it will be appreciated that the characteristics of the e-mail message that may be used in determining the minimum delay period could take many different forms, particularly well suited to use in this way are a sender address, a sender organisation, a recipient address, a recipient organisation, an attachment type and an e-mail message content type.
These characteristics may be used individually or in combination in many different ways. E-mail messages received from a particular organisation known to have a history of sending computer virus infected e-mails can be subject to a higher level of minimum delay period than e-mails received from other sources. However, if it is know that within such a sender organisation there is a particular sending individual who is careful to avoid sending computer virus infected e-mails, then e-mail messages from that particular individual may be subjected to a shorter minimum delay period if required. In a similar way, particular recipient organisations or recipient individuals may be known to be more likely to receive computer virus or unwanted e-mails and accordingly these recipient organisations or recipient individuals may have their received e-mails subject to a higher level of minimum delay period. If an e-mail message contains attachment types, then certain forms of attachment type represent a higher risk of computer virus infection, e.g. executable file attachments or file attachments of a type that may contain a macrovirus are of a higher risk category than a plain text or pure data attachment. Similarly, certain e-mail message content types, such as for example html message content, may represent a higher likelihood of showing unwanted properties than other types, such as plain text.
It will be appreciated that if unwanted characteristics are detected, then various different courses of action are possible. For example, the e-mail message could be disinfected and sent onto the recipient, offending attachments could be blocked but the remainder of the message sent on or the e-mail message in its entirety could be blocked as the safest course of action.
Whilst it will be appreciated that the technique of the present invention could be used to reduce the problem of e-mails having a wide variety of unwanted properties, the present invention is particularly useful when those unwanted properties are the presence of computer viruses. In this context, the advantage of providing an extra minimum delay period before an e-mail message is passed on significantly increases the likelihood that updated virus definition data will be available to detect newly released viruses before they are passed on.
The advantage of the use of up-to-date virus definition data is enhanced when this data is automatically periodically updated, particularly using a remote internet server.
Another type of e-mail having unwanted properties which the present invention helps to detect and prevent being spread is spam e-mail containing common characteristics. The minimum delay period imposed by the technique of the invention allows a threshold level of e-mail messages having the common characteristics to be detected prior to any of the spam e-mails being passed onto the recipients and so allows all of the spam e-mail messages to be blocked. A large number of spam e-mails may be received within a short period of time and so the minimum delay period may be relatively short and still be effective at reducing spam e-mail reaching users.
The common characteristics that can be used to identify spam e-mails include a common sender, a common recipient, a common message title, a common message size, a common attachment, a common attachment type and a common message context amongst other possible indicators of spam e-mail.
It will be appreciated that an e-mail message is often relayed through several computer systems prior to reaching its recipient. If each of these systems imposes its own minimum delay period, then the propagation time for the e-mail message could be increased too greatly. Accordingly, in preferred embodiments the invention include adding applied delay data to an e-mail message when a minimum delay period has been applied to it. This applied delay data may then be detected by subsequent systems through which the e-mail message passes and the imposition of further minimum delays selectively disabled if so chosen.
In order to reduce the possibility of tampering with such applied delay data in an attempt to circumvent the minimum delay period imposed, authentication data may also be applied to an e-mail message in conjunction with applied delay data so that the applied delay data may be properly authenticated.
Whilst the present invention may be considered to be most readily applicable to an e-mail server receiving e-mail messages for attached client e-mail systems, the technique may also be applied to outbound messages from that server or within purely relay servers that do not have any of their own e-mail client systems.
In order to reduce the delay in propagation once the minimum delay period has expired, preferred embodiments can apply tests to detect the unwanted properties as soon as an e-mail message is received or whilst it is being stored for the minimum delay period, and then these tests repeated only if they have been updated once the minimum delay period has expired.
It will be appreciated that the tests for unwanted properties could be updated by pull techniques whereby the system performing the tests itself sought to access updated tests or alternatively by push techniques whereby updated tests are sent to the system applying those tests without the system first requesting them. The invention is particularly well suited to systems which apply a pull update technique as a pull update can be attempted prior to expiry of the minimum delay period in order that the most accurate assessment may be made of what is the current state of the tests for unwanted properties prior to release to the recipient of an e-mail message. A pull could be attempted selectively when a high risk message was received, such as a message having an executable attachment.
Viewed from another aspect the invention also provides apparatus for detecting an e-mail message having one or more unwanted properties using one or more tests, said one or more tests being updateable in response to detection of new unwanted properties, said apparatus comprising:
a receiver operable to receive an e-mail message having associated one or more e-mail message characteristics and addressed to one or more recipients for said e-mail message;
delay determining logic operable to determine a minimum delay period in dependence upon said one or more e-mail message characteristics;
a storage device operable to store said e-mail message for said minimum delay period;
test logic operable to apply said one or more tests current at expiry of said minimum delay period to said e-mail message to identify if said e-mail message has any of said one or more of unwanted properties; and
mail processing logic operable if said e-mail message does not have any of said one or more unwanted properties to send said e-mail message to said one or more recipients and operable if said e-mail message does have any of said one or more unwanted properties to block sending of at least a portion of said e-mail message to said one or more recipients.
Viewed from a further aspect the invention also provides a computer program product carrying a computer program for controlling a computer to detect an e-mail message having one or more unwanted properties using one or more tests, said one or more tests being updateable in response to detection of new unwanted properties, said computer program comprising:
receiver code operable to receive an e-mail message having associated one or more e-mail message characteristics and addressed to one or more recipients for said e-mail message;
delay determining code operable to determine a minimum delay period in dependence upon said one or more e-mail message characteristics;
storage code operable to store said e-mail message for said minimum delay period;
test logic operable to apply said one or more tests current at expiry of said minimum delay period to said e-mail message to identify if said e-mail message has any of said one or more of unwanted properties; and
mail processing code operable if said e-mail message does not have any of said one or more unwanted properties to send said e-mail message to said one or more recipients and operable if said e-mail message does have any of said one or more unwanted properties to block sending of at least a portion of said e-mail message to said one or more recipients.